cobaltstrike | 013c1614cbd7b539816534fc02d56cfdd642ce21a9e935605dfb30aa15de5f59

Sharing

Copy URL Twitter E-mail

General

Target
013c1614cbd7b539816534fc02d56cfdd642ce21a9e935605dfb30aa15de5f59
Size 399KB
Sample260812-lamfdszzhy
SHA256 013c1614cbd7b539816534fc02d56cfdd642ce21a9e935605dfb30aa15de5f59
MD5 0f4731aa1b97b92329481ec0d2fdec00
SHA1 a29473771845fcdbfa507c0e0e6c2f5cadcbcb0e
SHA512 6d968e773f3464e723775b11e171fc8c17cd303a043227cb64e48470fd406646e1d92738a8ac2dba74223c7e5bd467c7bf7d30255b959b22f61641c3ccad23e9
SSDEEP 12288:9qgoF/ovQQNS3bwD6eBnAJhnVJRdWx8Pf+OrkdDm:IgdvQMSrY6xDG8X+ZdDm
TLSH
T11594236E198C20BFF13EE038ABE974A24967D0BCD4DDC43E9A7D3872A2570F0559710A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cobaltstrike 0 backdoor discovery execution persistence trojan websettings

Malware Config

Extracted

Rule

Microsoft Office WebSettings Relationship

http://job.softline.top/banner.jpg

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://job.softline.top/SCHEDLGU.exe

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://job.softline.top/loadinglit.gif

Targets

- Target
  InQuest-samples/2018-04-Common-Malware-Carrier/banner.jpg
- Size 105KB
- SHA256 697bed3630e918b0d6a73d7c251cdd1c7dc62db0445f89224a05747091281d02
- MD5 e049d4200fd95b35b38cc73af5b9c0cb
- SHA1 90db33ee4aa9c3921e2beb8932ef4d5cbabf8117
- SHA512 cdf26c81f8e48c7adc144b9d317092c05c982a085900ad1486c2006ede0eded8159c7df350ea69622c453bd5f5debce243e812d32ba48d49cdfaadbf374dc835
- SSDEEP 384:+W8aCyjzFdozPEFk8knpvZAN4VS7vZAN9i6rGspmmBckDl4sfnZiqYUDnMNLBY:+W8aLQrpgngGEcDsfZINLBY
- TLSH
  T17DB3BFEC59DA038AD3C59395DF61F0849DA6F05860FA8464317BC5BE436F82EFCA9831
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  InQuest-samples/2018-04-Common-Malware-Carrier/d347e095369aba294f674331054df8469b12d5e3260deb168827142d862f88d6
- Size 142KB
- SHA256 d347e095369aba294f674331054df8469b12d5e3260deb168827142d862f88d6
- MD5 df55633ede8a7905083f6397513a4af2
- SHA1 0e45b003bf33dc49037e0840a74f2221a10f625e
- SHA512 ef6a6110429db763921139ff853c3cb156152e61afa203b8c80d14816fd8a90f5a5f3edc3422875590538763f617179a616e7693a5c93e12a41ef6bbe3e49bd2
- SSDEEP 3072:XnTQ/2Ml3BNjuz5ri6+Em0GncPoKSDJ4nVF6G:XTQ/24BNjwriFyPo2L
- TLSH
  T1CCE3E074D211EA7FE05059F830531123A54D8E2A7184E91855CFAE6F2B43F2A4E37FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  InQuest-samples/2018-04-Common-Malware-Carrier/loadinglit.gif
- Size 271KB
- SHA256 c7d56e373626b0f0dcd81078a6a2925016757cd8bfcba5afd4ec7eab83e055cf
- MD5 b7dc4c7246f12e06cfbaf77a5f29f1ef
- SHA1 15ca8986f40602b55eecbecfa1d6a10529d84889
- SHA512 23b63904bc33bfdb557883dd1e5c9b18ee845de96c2ffd18c7a02ab09bcd55b2383cd499b55eabd741e6e845bb23f5c2b6b50f3428738ecbafbf88d7e5fbfc96
- SSDEEP 6144:Y8eaivieAEfHNH3sLxfJS8CO36j/HmISdu2dzy8WqHtObjn/dT0itlVMz:Y0iviKHNXsLxhRqTGLd+OWd4fz
- TLSH
  T16B44B036C417BEEB2A7E188CD00D3C819D283ADB8A185659FF4C6163B6CD5149DACCBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral5 behavioral6
- Target
  InQuest-samples/2018-04-Common-Malware-Carrier/payload
- Size 202KB
- SHA256 8cdd29e28daf040965d4cad8bf3c73d00dde3f2968bab44c7d8fe482ba2057f9
- MD5 9d7376f5ad1b39ec08cbe2a8e0e886b6
- SHA1 d5f5dc54861e1ea7d7a9c03e31f4a8a5c5b08bb0
- SHA512 f6d2b411254ef806398f1b319d230dc9776082c97db87d3d8dd6c1f44532063b12a6da0311a7a50dc3075726956ceecee2e266132b6e419e497b6951d4d7c425
- SSDEEP 3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15ad:PjdFKdoSxvixTxUA
- TLSH
  T1ED148DA131C4D036D0570479624BC77E5EBDFDF416B19487BF841AA6AE713A3EB2A203
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  InQuest-samples/2018-04-Common-Malware-Carrier/share.png
- Size 1KB
- SHA256 acec4a38d7b5ef95a2e33dce721c5693e7da966b751ec45bfa3e39b5181c6b19
- MD5 2c9f13f79f1dd88b9b5b1ab3a6e2374b
- SHA1 fc7f2e1ad64070be4d44b583155b2ec2af18cb03
- SHA512 f01fa0a0549a9a26a41dc9ab4f22052d92a699bb7bbd505710034878335ff3e42c624635691e7089fd12d38eaae0613413350f08905a56078b86852842e564f6
- TLSH
  T1A12163F5B597F1DCCFB82455D1DFA984B22824EC3361DA80BCC88A94280C92C97B71EC
- MD5 SHA1 SHA512 TLSH
Score

10^/10

execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Adds Run key to start application
  persistence
behavioral10 behavioral9